CVE-2022-49926
01.05.2025, 15:16
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: Fix possible memory leaks in dsa_loop_init()
kmemleak reported memory leaks in dsa_loop_init():
kmemleak: 12 new suspected memory leaks
unreferenced object 0xffff8880138ce000 (size 2048):
comm "modprobe", pid 390, jiffies 4295040478 (age 238.976s)
backtrace:
[<000000006a94f1d5>] kmalloc_trace+0x26/0x60
[<00000000a9c44622>] phy_device_create+0x5d/0x970
[<00000000d0ee2afc>] get_phy_device+0xf3/0x2b0
[<00000000dca0c71f>] __fixed_phy_register.part.0+0x92/0x4e0
[<000000008a834798>] fixed_phy_register+0x84/0xb0
[<0000000055223fcb>] dsa_loop_init+0xa9/0x116 [dsa_loop]
...
There are two reasons for memleak in dsa_loop_init().
First, fixed_phy_register() create and register phy_device:
fixed_phy_register()
get_phy_device()
phy_device_create() # freed by phy_device_free()
phy_device_register() # freed by phy_device_remove()
But fixed_phy_unregister() only calls phy_device_remove().
So the memory allocated in phy_device_create() is leaked.
Second, when mdio_driver_register() fail in dsa_loop_init(),
it just returns and there is no cleanup for phydevs.
Fix the problems by catching the error of mdio_driver_register()
in dsa_loop_init(), then calling both fixed_phy_unregister() and
phy_device_free() to release phydevs.
Also add a function for phydevs cleanup to avoid duplacate.Enginsight| Vendor | Product | Version |
|---|---|---|
| linux | linux_kernel | 4.12 ≤ 𝑥 < 4.14.299 |
| linux | linux_kernel | 4.15 ≤ 𝑥 < 4.19.265 |
| linux | linux_kernel | 4.20 ≤ 𝑥 < 5.4.224 |
| linux | linux_kernel | 5.5 ≤ 𝑥 < 5.10.154 |
| linux | linux_kernel | 5.11 ≤ 𝑥 < 5.15.78 |
| linux | linux_kernel | 5.16 ≤ 𝑥 < 6.0.8 |
| linux | linux_kernel | 6.1:rc1 |
| linux | linux_kernel | 6.1:rc2 |
| linux | linux_kernel | 6.1:rc3 |
𝑥
= Vulnerable software versions
Debian Releases
Common Weakness Enumeration
References